manual upgrades

mandiant · Oct 16, 2023 · 1451da7 · 1451da7
1 parent 364413c
commit 1451da7
Show file tree

Hide file tree

Showing 5 changed files with 9 additions and 7 deletions.
diff --git a/host-interaction/process/inject/allocate-or-change-rwx-memory.yml b/host-interaction/process/inject/allocate-or-change-rwx-memory.yml
@@ -5,8 +5,8 @@ rule:
     authors:
       - "@mr-tz"
     scopes:
-      - static: basic block
-      - dynamic: unspecified  # TODO upgrade manually, contains match
+      static: basic block
+      dynamic: unspecified  # TODO upgrade manually, contains match
     mbc:
       - Memory::Allocate Memory [C0007]
     examples:

diff --git a/lib/allocate-or-change-rw-memory.yml b/lib/allocate-or-change-rw-memory.yml
@@ -6,8 +6,8 @@ rule:
       - "@mr-tz"
     lib: true
     scopes:
-      - static: basic block
-      - dynamic: unspecified  # TODO upgrade manually, contains match
+      static: basic block
+      dynamic: unspecified  # TODO upgrade manually, contains match
     mbc:
       - Memory::Allocate Memory [C0007]
     examples:

diff --git a/lib/change-memory-protection.yml b/lib/change-memory-protection.yml
@@ -4,7 +4,9 @@ rule:
     authors:
       - "@mr-tz"
     lib: true
-    scope: basic block
+    scopes:
+      static: basic block
+      dynamic: unspecified  # TODO upgrade manually, contains match
     mbc:
       - Memory::Change Memory Protection [C0008]
     examples:

diff --git a/persistence/startup-folder/get-startup-folder.yml b/persistence/startup-folder/get-startup-folder.yml
@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: basic block
-      dynamic: call  # TODO check if scope thread instead
+      dynamic: call
     att&ck:
       - Persistence::Boot or Logon Autostart Execution::Registry Run Keys / Startup Folder [T1547.001]
     examples:

diff --git a/persistence/startup-folder/write-file-to-startup-folder.yml b/persistence/startup-folder/write-file-to-startup-folder.yml
@@ -6,7 +6,7 @@ rule:
       - [email protected]
     scopes:
       static: function
-      dynamic: unspecified  # TODO upgrade manually, contains match
+      dynamic: thread
     att&ck:
       - Persistence::Boot or Logon Autostart Execution::Registry Run Keys / Startup Folder [T1547.001]
     examples: